> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-messages.md).

# Management audit log messages

Cortex Cloud management audit log messages are sent based on the various log types, for example, Action Center, Issue Rules, or Authentication.

<details>

<summary>List of log types</summary>

* Action Center
* Agent Configuration
* Agent Exception Rules
* Issue Exclusion
* Issue Management
* Issue Notifications
* Issue Rules
* Issue Exclusions
* Allowed Domains
* API Key
* Apps
* Asset Inventory
* Asset Roles
* Asset Tag Rules
* Asset Uploads
* Authentication
* Automation Rules
* Automation Settings
* Broker API
* Broker VMs
* Business Unit Change
* SaaS Collection
* Custom Fields
* Dashboards
* Datasets
* Dataset Views
* Data Retention
* Device Control Custom Device
* Device Control Permanent Exceptions
* Extensions Policy Rules
* Device Control Profile
* Device Control Temporary Exceptions
* Agent Installation
* EDL Management
* Effective IP Ranges
* Endpoint Groups
* Endpoint Administration
* Event Forwarding
* Device Control Violations
* Device Permanent Exceptions
* Device Temp Exceptions
* Disk Encryption Visibility
* Featured Alert Fields
* Forensics
* Global Exceptions
* Host Insights
* Disk Encryption Profile
* Host Firewall
* Host Firewall Profile
* Case Domains
* Case Layout Rules
* Case Management
* Case Properties
* Case Timeline Event
* Indicator rules
* Ingest Data
* Integrations
* Layout Rules
* Licensing
* Live Terminal
* Lookups
* Managed Detection & Response
* Managed Threat Hunting
* MSSP
* Permissions
* Policy & Profiles
* Prevention Policy Rules
* Prisma Integration
* Extensions Profile
* Public API
* Query Center
* Query Library
* Remediation
* Remediation Path Rules
* Reporting
* Response
* Rules
* Rules Exceptions
* Scoring Rules
* XDR Collector Configuration
* XDR Collectors Groups
* XDR Collectors Policy
* XDR Collectors Profile
* Script Execution
* Security Settings
* Server Settings
* Starred Incidents
* Support
* System
* Tenant Takeover
* Vulnerability Assessment
* Vulnerability Tests
* XCloud Integration
* XDM Config
* XQL Parsing Rules
* Public API
* Cortex Automation
  * Sub Type—Command - War Room
    * Status—Success
    * Severity—Informational
    * Details— `IncidentID:({ID}), IncidentType:({type}), IncidentName:({name}), Command:({command}), Arguments:({arg1})="arg1val" ({arg2})="arg2val" ({argn})="argnval", ID: ({num})`
  * Sub Type—Command - Playground
    * Status—Success
    * Severity—Informational

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-messages.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.